bump version

CHANGELOG

@@ -1,3 +1,19 @@
+28 April 2017: mitmproxy 2.0.2
+
+    * Fix mitmweb's Content-Security-Policy to work with Chrome 58+
+
+    * HTTP/2: actually use header normalization from hyper-h2
+
+
+15 March 2017: mitmproxy 2.0.1
+
+    * bump cryptography dependency
+
+    * bump pyparsing dependency
+
+    * HTTP/2: use header normalization from hyper-h2
+
+
 21 February 2017: mitmproxy 2.0
 
     * HTTP/2 is now enabled by default.

mitmproxy/proxy/protocol/http2.py

@@ -97,7 +97,6 @@ class Http2Layer(base.Layer):
             client_side=False,
             header_encoding=False,
             validate_outbound_headers=False,
-            normalize_outbound_headers=False,
             validate_inbound_headers=False)
         self.connections[self.client_conn] = SafeH2Connection(self.client_conn, config=config)
 
@@ -107,7 +106,6 @@ class Http2Layer(base.Layer):
                 client_side=True,
                 header_encoding=False,
                 validate_outbound_headers=False,
-                normalize_outbound_headers=False,
                 validate_inbound_headers=False)
             self.connections[self.server_conn] = SafeH2Connection(self.server_conn, config=config)
         self.connections[self.server_conn].initiate_connection()
@@ -599,9 +597,6 @@ class Http2SingleStreamLayer(httpbase._HttpTransmissionLayer, basethread.BaseThr
     def send_response_headers(self, response):
         headers = response.headers.copy()
         headers.insert(0, ":status", str(response.status_code))
-        for forbidden_header in h2.utilities.CONNECTION_HEADERS:
-            if forbidden_header in headers:
-                del headers[forbidden_header]
         with self.connections[self.client_conn].lock:
             self.connections[self.client_conn].safe_send_headers(
                 self.raise_zombie,

mitmproxy/tools/web/app.py

@@ -119,7 +119,7 @@ class RequestHandler(tornado.web.RequestHandler):
         self.add_header(
             "Content-Security-Policy",
             "default-src 'self'; "
-            "connect-src 'self' ws://* ; "
+            "connect-src 'self' ws:; "
             "style-src   'self' 'unsafe-inline'"
         )
 

mitmproxy/version.py

@@ -1,4 +1,4 @@
-IVERSION = (2, 0, 0)
+IVERSION = (2, 0, 2)
 VERSION = ".".join(str(i) for i in IVERSION)
 PATHOD = "pathod " + VERSION
 MITMPROXY = "mitmproxy " + VERSION

setup.py

@@ -64,7 +64,7 @@ setup(
         "click>=6.2, <7",
         "certifi>=2015.11.20.1",  # no semver here - this should always be on the last release!
         "construct>=2.8, <2.9",
-        "cryptography>=1.3, <1.8",
+        "cryptography>=1.3, <1.9",
         "cssutils>=1.0.1, <1.1",
         "h2>=2.5.1, <3",
         "html2text>=2016.1.8, <=2016.9.19",
@@ -74,7 +74,7 @@ setup(
         "passlib>=1.6.5, <1.8",
         "pyasn1>=0.1.9, <0.3",
         "pyOpenSSL>=16.0, <17.0",
-        "pyparsing>=2.1.3, <2.2",
+        "pyparsing>=2.1.3, <2.3",
         "pyperclip>=1.5.22, <1.6",
         "requests>=2.9.1, <3",
         "ruamel.yaml>=0.13.2, <0.14",

test/mitmproxy/proxy/protocol/test_http2.py

@@ -271,75 +271,6 @@ class TestSimple(_Http2Test):
         assert response_body_buffer == b'response body'
 
 
-@requires_alpn
-class TestForbiddenHeaders(_Http2Test):
-
-    @classmethod
-    def handle_server_event(cls, event, h2_conn, rfile, wfile):
-        if isinstance(event, h2.events.ConnectionTerminated):
-            return False
-        elif isinstance(event, h2.events.StreamEnded):
-            import warnings
-            with warnings.catch_warnings():
-                # Ignore UnicodeWarning:
-                # h2/utilities.py:64: UnicodeWarning: Unicode equal comparison
-                # failed to convert both arguments to Unicode - interpreting
-                # them as being unequal.
-                #     elif header[0] in (b'cookie', u'cookie') and len(header[1]) < 20:
-
-                warnings.simplefilter("ignore")
-
-                h2_conn.config.validate_outbound_headers = False
-                h2_conn.send_headers(event.stream_id, [
-                    (':status', '200'),
-                    ('keep-alive', 'foobar'),
-                ])
-            h2_conn.send_data(event.stream_id, b'response body')
-            h2_conn.end_stream(event.stream_id)
-            wfile.write(h2_conn.data_to_send())
-            wfile.flush()
-        return True
-
-    def test_forbidden_headers(self):
-        client, h2_conn = self._setup_connection()
-
-        self._send_request(
-            client.wfile,
-            h2_conn,
-            headers=[
-                (':authority', "127.0.0.1:{}".format(self.server.server.address.port)),
-                (':method', 'GET'),
-                (':scheme', 'https'),
-                (':path', '/'),
-            ])
-
-        done = False
-        while not done:
-            try:
-                raw = b''.join(http2.read_raw_frame(client.rfile))
-                events = h2_conn.receive_data(raw)
-            except exceptions.HttpException:
-                print(traceback.format_exc())
-                assert False
-
-            client.wfile.write(h2_conn.data_to_send())
-            client.wfile.flush()
-
-            for event in events:
-                if isinstance(event, h2.events.ResponseReceived):
-                    assert 'keep-alive' not in event.headers
-                elif isinstance(event, h2.events.StreamEnded):
-                    done = True
-
-        h2_conn.close_connection()
-        client.wfile.write(h2_conn.data_to_send())
-        client.wfile.flush()
-
-        assert len(self.master.state.flows) == 1
-        assert self.master.state.flows[0].response.status_code == 200
-        assert self.master.state.flows[0].response.headers['keep-alive'] == 'foobar'
-
-
 @requires_alpn
 class TestRequestWithPriority(_Http2Test):